Bump github.com/evanphx/json-patch from 4.12.0+incompatible to 5.9.11+incompatible#478
Conversation
dependabot
bot
added
area/dependency
|
🚨 Major Version Update Detected 🚨 This PR contains a major version update that requires manual review:
Please review the changelog and breaking changes before merging. Auto-merge has been disabled for this PR. |
WalkthroughBumped Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
dependabot
bot
force-pushed
the
dependabot/go_modules/github.com/evanphx/json-patch-5.9.11incompatible
branch
from
36adfeb to
144b3f1
Compare
|
🚨 Major Version Update Detected 🚨 This PR contains a major version update that requires manual review:
Please review the changelog and breaking changes before merging. Auto-merge has been disabled for this PR. |
dependabot
bot
force-pushed
the
dependabot/go_modules/github.com/evanphx/json-patch-5.9.11incompatible
branch
from
144b3f1 to
59d545d
Compare
|
🚨 Major Version Update Detected 🚨 This PR contains a major version update that requires manual review:
Please review the changelog and breaking changes before merging. Auto-merge has been disabled for this PR. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 6: The go.mod entry for the dependency github.com/evanphx/json-patch is
pinned as v5.9.11+incompatible, indicating the upstream uses v5 semantics
without the proper /v5 import path; check the upstream repository for a proper
module v5 release (module path github.com/evanphx/json-patch/v5) and, if
available, update imports and go.mod to use the canonical v5 module path and
version (replace github.com/evanphx/json-patch v5.9.11+incompatible with
github.com/evanphx/json-patch/v5 v5.x.y), run go mod tidy and fix any import
lines that should change from github.com/evanphx/json-patch to
github.com/evanphx/json-patch/v5 across the codebase.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e3af32b6-abd0-4d29-9ee0-dfd87b9c54d6
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
|
|
||
| require ( | ||
| github.com/evanphx/json-patch v4.12.0+incompatible | ||
| github.com/evanphx/json-patch v5.9.11+incompatible |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check for inconsistent import paths across the codebase
echo "=== Direct imports of github.com/evanphx/json-patch (unversioned) ==="
rg -n --type=go '"github\.com/evanphx/json-patch"' -C 2
echo -e "\n=== Direct imports of github.com/evanphx/json-patch/v5 (versioned) ==="
rg -n --type=go '"github\.com/evanphx/json-patch/v5"' -C 2
echo -e "\n=== Count of each import style ==="
echo -n "Unversioned imports: "
rg -c --type=go '"github\.com/evanphx/json-patch"' | wc -l
echo -n "Versioned (/v5) imports: "
rg -c --type=go '"github\.com/evanphx/json-patch/v5"' | wc -lRepository: openshift/managed-cluster-validating-webhooks
Length of output: 653
The go.mod entry uses the +incompatible suffix, which indicates improper Go module versioning.
Line 6 shows github.com/evanphx/json-patch v5.9.11+incompatible. The +incompatible suffix means this library is using v5 semantics but without adopting the proper /v5 import path convention for Go modules v1.11+. The codebase correctly imports it as github.com/evanphx/json-patch (unversioned) in one location. The versioned path (github.com/evanphx/json-patch/v5) appearing in go.mod is a transitive dependency—this is normal and not a problem.
The concern is whether this library should be migrated to its proper versioned import path if the library maintainers have adopted that convention. Verify the upstream library's current status and consider updating the import if a properly-versioned version is available.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 6, The go.mod entry for the dependency
github.com/evanphx/json-patch is pinned as v5.9.11+incompatible, indicating the
upstream uses v5 semantics without the proper /v5 import path; check the
upstream repository for a proper module v5 release (module path
github.com/evanphx/json-patch/v5) and, if available, update imports and go.mod
to use the canonical v5 module path and version (replace
github.com/evanphx/json-patch v5.9.11+incompatible with
github.com/evanphx/json-patch/v5 v5.x.y), run go mod tidy and fix any import
lines that should change from github.com/evanphx/json-patch to
github.com/evanphx/json-patch/v5 across the codebase.
Bumps [github.com/evanphx/json-patch](https://github.com/evanphx/json-patch) from 4.12.0+incompatible to 5.9.11+incompatible. - [Release notes](https://github.com/evanphx/json-patch/releases) - [Commits](evanphx/json-patch@v4.12.0...v5.9.11) --- updated-dependencies: - dependency-name: github.com/evanphx/json-patch dependency-version: 5.9.11+incompatible dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
force-pushed
the
dependabot/go_modules/github.com/evanphx/json-patch-5.9.11incompatible
branch
from
59d545d to
98badc1
Compare
|
🚨 Major Version Update Detected 🚨 This PR contains a major version update that requires manual review:
Please review the changelog and breaking changes before merging. Auto-merge has been disabled for this PR. |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
go.mod (1)
6-6:⚠️ Potential issue | 🟠 MajorAvoid mixed json-patch module paths (
+incompatibleand/v5) in the same module graph.Line 6 pins
github.com/evanphx/json-patch v5.9.11+incompatiblewhile Line 36 also resolvesgithub.com/evanphx/json-patch/v5 v5.9.11indirectly. This split path usage is a maintainability risk and can lead to inconsistent behavior across packages that import different paths.#!/bin/bash # Verify whether both json-patch import paths are used and where. # Expected: # - Prefer a single canonical import path across the repo. # - If both are present, plan migration to one path. echo "=== go.mod entries ===" rg -n -C2 'github\.com/evanphx/json-patch(/v5)?\s+v' go.mod echo echo "=== Direct Go imports: unversioned path ===" rg -nP --type=go -C2 '"github\.com/evanphx/json-patch"' echo echo "=== Direct Go imports: /v5 path ===" rg -nP --type=go -C2 '"github\.com/evanphx/json-patch/v5"'As per coding guidelines, "Focus on major issues impacting performance, readability, maintainability and security. Avoid nitpicks and avoid verbosity."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@go.mod` at line 6, The go.mod currently mixes two import paths for the same module (github.com/evanphx/json-patch and github.com/evanphx/json-patch/v5); pick the canonical v5 path and migrate: remove the +incompatible entry and add/replace it with github.com/evanphx/json-patch/v5 v5.9.11 in go.mod, update all Go source imports from "github.com/evanphx/json-patch" to "github.com/evanphx/json-patch/v5", then run go get/module tidy to reconcile module graph and go vet/build to ensure no remaining unversioned imports; verify with the provided grep/ripgrep checks for both import forms and fix any remaining occurrences.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@go.mod`:
- Line 6: The go.mod currently mixes two import paths for the same module
(github.com/evanphx/json-patch and github.com/evanphx/json-patch/v5); pick the
canonical v5 path and migrate: remove the +incompatible entry and add/replace it
with github.com/evanphx/json-patch/v5 v5.9.11 in go.mod, update all Go source
imports from "github.com/evanphx/json-patch" to
"github.com/evanphx/json-patch/v5", then run go get/module tidy to reconcile
module graph and go vet/build to ensure no remaining unversioned imports; verify
with the provided grep/ripgrep checks for both import forms and fix any
remaining occurrences.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 94db09fa-e988-4c37-9e90-923721ea1a40
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Bumps github.com/evanphx/json-patch from 4.12.0+incompatible to 5.9.11+incompatible.
Release notes
Sourced from github.com/evanphx/json-patch's releases.
... (truncated)
Commits
84a4bb1Merge pull request #209 from skitt/export-errs-v57a7a88aExport errBadJSONDoc and errBadJSONPatch errorsbd18525Upgrade go-flags42f26cbFix spacing0a3482bMerge pull request #206 from koba1t/remove_unmaintained_error_pkg106306dremove unmaintained errors pkge7cfbbbMerge pull request #203 from skitt/drop-gopkgin-v561e1ad7Drop the reference to gopkg.in for v5b7a4e4aMerge pull request #202 from evanphx/f-html-escape7eef36cGuard using options to avoid a crash bugDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)